Device and method for encryption

Abstract

Device (300) for encryption, comprising: a transformation network (100) with at least two stages (110a, 110b, 110c) of butterfly operations, wherein the transformation network (100) is configured to perform a discrete Fourier transformation over rings of multiple input signals (f0 - f7) to obtain multiple output signals (f̂0 - f̂7); an error detection device (110) configured to obtain at least a subset of the multiple input signals (f0 - f7) and at least a subset of the multiple output signals (f0 - f̂7) of the transformation network (100) and to perform an error analysis, wherein the error analysis is based on a comparison of a first linear combination of the subset of the multiple input signals (f0 - f7) to a second linear combination of the subset of the multiple output signals (f0 - f̂7).

Description

[0001] Exemplary embodiments of the present invention relate to a device and a method for encryption, as well as a corresponding data carrier and a computer program. Further exemplary embodiments relate to a device, a method, or a computer program for determining weights.

[0002] Modern security concepts often employ public-key cryptography (PKC, also known as asymmetric cryptography). Typical applications include automotive systems, such as key exchange or software update verification. However, current PKC algorithms, such as Rivest-Shamir-Adleman encryption or Elliptic Curve Encryption (ECC), no longer meet sufficient security requirements in light of quantum computers. Encryption variants that meet these increased requirements are called PQC (Post-Quantum Cryptography). Several PQC variants exist, each offering a good compromise between performance, key size, and security requirements.One of the most complex computer operations in these areas is the so-called Number-Theoretic Transform (NTT, also known as the discrete Fourier transform over (commutative or algebraic) rings). This NTT exists in both its standard and inverse forms, making it a typical candidate for hardware acceleration (HW). The NTT, or inverse NTT, is a mathematical transformation and is often implemented by decomposing it into multiple stages, each of which contains several butterfly operations.

[0003] Fault injection is a typical approach used by attackers to analyze security systems. To detect such attacks, error detection is employed in encryption methods. Many applications, such as automotive applications, also require error detection.

[0004] The object of the present invention is to create a concept for error detection in encryptions that exhibits an improved compromise between efficiency and reliability.

[0005] The problem is solved by the subject matter of the independent patent claims.

[0006] Exemplary embodiments of the present invention provide an encryption device comprising a transformation network and an error detection device. The transformation network has at least two stages of butterfly operations and is configured to perform a discrete Fourier transform over, for example, commutative or algebraic rings of multiple input signals to obtain multiple output signals. The error detection device is configured to obtain at least a subset of the multiple input signals and at least a subset of the multiple output signals of the transformation network and to perform an error analysis, wherein the error analysis is based on a comparison of a first linear combination of the subset of multiple input signals to a second linear combination of the subset of multiple output signals.

[0007] Another embodiment provides a data carrier comprising a first and a second software component. The first software component is configured to implement a transformation network with at least two stages of butterfly operations, wherein the transformation network is configured to perform a discrete Fourier transform over rings of multiple input signals to obtain multiple output signals. The second software component is configured to implement an error detection device, which is configured to obtain at least a subset of the multiple input signals and at least a subset of the multiple output signals of the transformation network and to perform an error analysis. The error analysis is based on a comparison of a first linear combination of the subset of multiple input signals to a second linear combination of the subset of multiple output signals.

[0008] Another embodiment provides a method for encryption comprising the following steps: Performing a transformation of multiple input signals using a transformation network with at least two stages of butterfly operations to obtain multiple output signals; Obtain at least a subset of the multiple input signals and at least a subset of the multiple output signals of the transformation network and perform an error analysis, wherein the error analysis is based on a comparison of a first linear combination of the subset of multiple input signals to a second linear combination of the subset of multiple output signals.

[0009] Another embodiment provides a device for determining first weights and second weights depending on a transformation network that has at least two stages of butterfly operations and is configured to perform a discrete Fourier transformation over rings of multiple input signals in order to obtain at least multiple output signals. - wherein a first linear combination of the subset of multiple input signals can be computed using the first weights, and wherein a second linear combination of the subset of multiple output signals can be computed using the second weights, - where the first and second weights are determined such that a calculated value of the first linear combination equals a calculated value of the second linear combination if the encryption was performed without errors.

[0010] Another embodiment provides a method for determining first and second weights depending on a transformation network that has at least two stages of butterfly operations and is configured to perform a discrete Fourier transformation over rings of multiple input signals in order to obtain at least multiple output signals. - wherein a first linear combination of the subset of multiple input signals can be computed using the first weights, and wherein a second linear combination of the subset of multiple output signals can be computed using the second weights, - where the first and second weights are determined such that a calculated value of the first linear combination equals a calculated value of the second linear combination if the encryption was performed without errors.

[0011] Another embodiment uses a computer program to carry out the procedures described above.

[0012] Further training is defined in the sub-requirements.

[0013] Exemplary embodiments of the present invention are explained below with reference to the accompanying drawings. These show: Fig. 1. An exemplary block diagram of a transformation network to illustrate the underlying transformation; Fig. 2 a schematic block diagram to illustrate a butterfly operation; Fig. 3 a schematic block diagram of a transformation network in combination with a fault detection device according to exemplary embodiments; Fig. 4. A schematic flowchart for fault detection; Fig. 5 a schematic block diagram of a device with transformation network and fault detection device for single fault detection according to exemplary embodiments; Fig. 6 a schematic block diagram of a device with a transformation network and a fault detection device for double fault detection according to further embodiments; and Fig. 7 a schematic block diagram of a device with a split transformation network and fault detection device according to further embodiments.

[0014] Before exemplary embodiments of the present invention are explained below with reference to the accompanying drawings, it should be noted that equivalent elements and structures are provided with the same reference numerals, so that their descriptions are applicable to each other or interchangeable.

[0015] Before exemplary embodiments of the present invention are explained, transformation networks with butterfly operations and butterfly operations are described as examples with reference to Fig. 1 and Fig. 2 explained.

[0016] Fig. Figure 1 shows an NTT network, or more generally, a transformation network 100 with three stages 110a-110c. The transformation network has eight inputs 102a-102h on the input side for the three stages 110a-110c and eight outputs 106a-106h on the output side. Each stage has so-called butterfly operations 120a-120l. Butterfly operations 120a-120d belong to the first stage 110a, butterfly operations 120e-120h to the second stage 110b, and butterfly operations 120i-120l to the third stage 110c. It should be noted that the transformation network can also have only two or more than three stages 110a and 110c with significantly fewer or more butterfly operations, e.g., two butterfly operations per stage. Based on this, the number of inputs and outputs is naturally reduced. For example, there are typically 8 stages with N=256 inputs. Background information.The focus of the implementation examples is on "complete" NTTs, i.e., log2(N) stages, where N is the number of inputs. Typical values ​​are N=256 or N=1024, although the actual function, as described, also applies to other values ​​of N (powers of 2, which is always the case with NTTs).

[0017] Each butterfly operation 120a has two inputs 103a and 103b and two outputs 104a and 104b (see Fig. 2) on. Based on Fig. 2. Element 120a is explained by way of example, whereby the explanation can be applied to all elements 120b-120l.

[0018] The first stage 110a has butterfly operands 120a-120d, each connected to two inputs 102a / b, 102c / d, ... and to two butterfly operands 120e-120h of the second stage 110b on the output side. The butterfly operands 120i-120l of the third stage 110c are connected to two outputs 106a / b, 106c / d, ... and to two butterfly operands 120e-120h of the second stage 110b on the input side. In other words, there is always cross-connection between stages 110a and 110b, as well as between stages 110b and 110c. For example, the butterfly operand 120e is connected to 120a and 120c on the input side and to 120i and 120j on the output side. The butterfly operand 120f is connected to 120a and 120c on the input side and to 120k and 120l on the output side.Thus, operands 120e and 120f have the same input connections, each connected to different outputs of the preceding butterfly operands 120a and 120c of the first stage 110a. For the sake of completeness, it should also be noted that 120g is connected to 120b and 120d on the input side and to 120i and 120j on the output side, while 120h is connected to 120b and 120d on the input side and to 120k and 120l on the output side. The connection shown here is exemplary; that is, it can vary on both the input and output sides, and varies particularly if each stage 110a-110c has more or fewer butterfly operands, or if there are more stages overall. In general, the transformation networks considered here, in particular NTT and...Inverse NTTs have in common that a multitude of stages 110a-110c are provided, with each stage having a fixed number of butterfly operations 120a-120l.

[0019] Each butterfly operation, according to the exemplary embodiments, has inputs 103a and 103b and outputs 104a and 104b. For example, 103a can be linked to 102a and 103b to 102b. 104a can, for example, be linked to butterfly operand 120e, while 104b is connected to butterfly operand 120f. Each butterfly operand (butterfly block) has internal circuitry so that each input 103a, 103b can be linked to any output 104a and 104b via a mathematical operation. Typical mathematical operations include multiplication (105m), addition (105a), and subtraction (105s). The butterfly operations are typically processed sequentially, with intermediate results being stored or loaded from a corresponding memory (not shown).

[0020] Errors can occur in any path within this network or its butterfly operands, either due to random hardware failures or error injection by malicious attackers. The state of the art for capturing these errors involves recalculating the arithmetic operations within the butterfly operations. These schemes are referred to below as recalculation schemes. For better coverage of different types of errors, some modifications are also considered, such as negating input signals and rearranging coefficients to modify the paths through the butterfly unit.

[0021] Different variations of this strategy were developed by Sarker and others. [3]Published. Although this strategy detects some errors, it has two major drawbacks. First, it can only locate errors that occur in the butterfly operand. If a coefficient is loaded incorrectly due to corruption in memory during the reading or writing of the previous result, these schemes cannot detect these errors. Second, since all arithmetic operations are performed twice, they cause a significant overhead, which manifests as increased computation time and / or computational space, as well as high dynamic power consumption. Furthermore, this overhead scales linearly with the number of butterfly operations performed in the network. Therefore, there is a need for an improved approach.

[0022] Exemplary embodiments of the present invention provide an encryption device 300 with a transformation network 100, e.g., an NTT or inverse NTT, which has a plurality of inputs 102a-102n or a plurality of outputs 106a-106n. The device 300 additionally includes an error detection device 310. This error detection device 310 is arranged in parallel to the transformation network 100 and receives as input signals both the input signals f0-f7 of the inputs 102a-102n and the output signals f̂0-f̂7 of the outputs 106a-106n.

[0023] The Transformation Network 100 can be used like the Transformation Network from Fig. 1 with the butterfly operations from Fig. The transformation network 100 can be implemented in a specific way or, in its minimal configuration, exhibit at least two stages of butterfly operations. It is designed to perform a discrete Fourier transform over, for example, algebraic rings of several input signals f0 - f7 of inputs 102a-102n to output several output signals f̂0 - f̂7 of outputs 106a-106n. Depending on the embodiments, the transformation network 100 can be part of an encryption device, such as a so-called post-quantum encryption device.

[0024] The fault detection device 310 is configured to obtain at least a subset of the multiple input signals f0-f7 of inputs 102a-102n and at least a subset of the multiple output signals f̂0-f̂7 of outputs 106a-106n in order to perform a fault analysis. The fault analysis comprises a comparison of a first linear combination of the subset of multiple input signals f0-f7 of inputs 102a-102n with a second linear combination of the subset of multiple output signals f̂0-f̂7 of outputs 106a-106n. For example, a checksum can be determined for the input signals f0-f7 of inputs 102a-102n and also for the output signals f̂0-f̂7 of outputs 106a-106n. According to exemplary embodiments, this checksum can be identical if no fault has occurred. Preferably, the checksum is not calculated as a simple sum, although that would of course be possible, but as a weight to the sum.This means that each input signal f0 - f7 of inputs 102a-102n or output signal f̂0 - f̂7 of outputs 106a-106n is weighted with a corresponding weight.

[0025] In other words, this means Fig. Figure 3 shows the functional structure of such a high-level error detection scheme. The error detection block 310 receives the input signals f̂0 - f̂7 and the output signal f̂0 - f̂7, which the NTT / transformation network 100 receives as inputs, and determines, using weights a0-a7 and b0-b7 respectively, the presence of errors occurring in the entire (inverse) NTT computation. This contrasts with recalculation schemes, where errors are detected at the level of individual butterfly operations.

[0026] For the sake of completeness, it should be noted that, in order to detect an error, the calculated values / checksums will differ if an error has occurred. For the chosen weights, this is guaranteed for a single error and very likely for multiple random errors. Depending on the implementation examples, several first and second weighting vectors, e.g., with different weights, can be used to detect double errors, as in the context of... Fig. 6 will be explained.

[0027] According to exemplary embodiments, the even-numbered inputs f0, f4, f2, and f6 can be processed by elements 120a and 120b, while the odd-numbered inputs f1, f5, f3, and f7 are processed by elements 120c and 120d. The same nomenclature is used on the output side, so that the following sequence of output signals is provided by elements 120i, 120j, 120k, and 120l: f̂0, f̂4, f̂2, f̂6, f1, f̂5, f̂3, and f̂7. Of course, other arrangements are possible, depending on the exemplary embodiments. Furthermore, elements 120a to 120l can also be connected in different configurations.

[0028] The weights for the input signals are called first weights, while the weights for the output signals are called second weights. Depending on the embodiment, the weights are chosen such that the condition of identical results for the first and second linear combinations is met, assuming no error occurs. For this purpose, the first and second weights depend on the transformation network and can be determined in advance. For example, the first and second weights associated with the transformation network are stored in a memory of the device. This means that, depending on the embodiment, the device has a memory location containing the first and second weights for the transformation network to be used. Depending on the embodiment, the transformation network can be implemented in software.That is, the weights belonging to a software component in which the transformation network is implemented are stored.

[0029] In other words, both Unit 100 and Unit 310 can exist as software components. The calculation of the linear combinations or checksums in Unit 310 is based on multiplication and addition. These mathematical operands are also present in the respective butterfly cells 120a-120l. This allows the transformation network itself to perform the calculation of the first and second linear combinations, thus encompassing the task of Unit 310.

[0030] One embodiment thus provides a data carrier comprising a first and a second software component. The first and / or the second software component can be executed on a corresponding processor, or both can be executed on the same processor. The first software component is configured to implement a transformation network with at least two stages of butterfly operations, wherein the transformation network is configured to perform a discrete Fourier transform over rings of multiple input signals to obtain multiple output signals.The second software component is designed to implement a fault detection device which is designed to obtain at least a subset of the multiple input signals and at least a subset of the multiple output signals of the transformation network in order to perform a fault analysis, wherein the fault analysis is based on a comparison of a first linear combination of the subset of multiple input signals to a second linear combination of the subset of multiple output signals.

[0031] Another embodiment provides a method for encryption, as described in Fig. Figure 4 shows that the procedure 400 comprises two central steps, 410 and 420. In step 410, a discrete Fourier transform is performed over rings of multiple input signals using a transformation network with two or more stages of butterfly operations to obtain multiple output signals. In the second step, 420, at least a subset of the multiple input signals and at least a subset of the multiple output signals from the transformation network are obtained (see Figure 422), and an error analysis is performed, 424. The error analysis is based on a comparison of a first linear combination of the subset of multiple input signals to a second linear combination of the subset of multiple output signals. In other words, the proposed error detection scheme works by calculating weighted sums of the input signals (in the sense of values ​​of the input signals or input values).Output signals (in the sense of values ​​of the output signals) of the (inverse) NTT.

[0032] According to the exemplary embodiments, a method for detecting errors in the calculation of transformations, such as (inverse) NTT, is described. These methods do not rely on recalculation but instead exploit the mathematical structure inherent in the NTT. Methods for guaranteed correction of single and double errors, as well as the application of the same principles to incomplete NTT, are described in more detail.

[0033] This method can be computer-implemented according to further embodiments. In this respect, a computer program is created to carry out the method or method steps 410, 420, 422 and 424 if the method 400 runs on a processor.

[0034] It should be noted here that the first weights can be defined by a first weighting vector a and the second weights by a second weighting vector b. The two weighting vectors a and b are based on the formula b = a · A, where A represents a matrix that describes the behavior and inverse behavior of transformation network 100, respectively.

[0035] The following is a detailed technical description for the case of a negatively enveloped, convolution-based NTT. This is the most relevant case for cryptographic applications. A more abstract definition follows, covering the different variations of NTT as well as the inverse NTT.

[0036] Since the error correction scheme considered in this invention operates solely with the input and output signals of the (inverse) NTT, the implementation units of the (inverse) NTT block are subsequently abstracted. Instead, only the linear transformation is considered, which can be described by an N × N matrix A, where the output signals f̂ relate to the input signals f by f̂ = A · f.

[0037] By defining the negatively enveloped convolution-based NTT, the matrix A is given by A=(ω2N0ω2N(2⋅0+1)⋅1⋯ω2N(2⋅0+1)⋅(N−1)ω2N0ω2N(2⋅1+1)⋅1⋯ω2N(2⋅1+1)⋅(N−1) ⋮⋮⋱⋮ω2N0ω2N(2⋅(N−1)+1)⋅1⋯ω2N(2⋅(N−1)+1)⋅(N−1)), where ω 2N The 2N-th primitive root of unity is the inverse NTT. The inverse NTT is defined as the mathematical inverse of this matrix.

[0038] In this respect, a further embodiment provides a calculation concept for finding the first and second weights, or the first weighting vector a and the second weighting vector b. For this purpose, a device can be provided, according to the embodiments, which is designed to determine the first and second weights as a function of the transformation network 100. This device determines the weights under the following two premises: - wherein a first linear combination of the subset of multiple input signals can be computed using the first weights, and wherein a second linear combination of the subset of multiple output signals can be computed using the second weights, - where the first and second weights are determined such that a calculated value of the first linear combination is equal to a calculated value of the second linear combination if the discrete Fourier transform over rings has been performed without error.

[0039] Generally speaking, for all the described schemes, the conditions for the weights lead to a space of solutions. From this space, it is possible to select weights that allow for efficient implementation. In particular, it is possible to set every second weight for the input signals (values) and the output signals (values) equal to one; that is, one of the inputs / outputs in each of the butterfly operations in the first / last stage. Then, by setting up and solving the linear system of equations b = a · A, one obtains a solution where half of the weights in the weighted sums are equal to one. This reduces the number of required multiplications from 2N to N.

[0040] Another embodiment provides a corresponding method for determining the first and second weights, also under the following conditions: - wherein a first linear combination of the subset of multiple input signals can be computed using the first weights, and wherein a second linear combination of the subset of multiple output signals can be computed using the second weights, - where the first and second weights are determined such that a calculated value of the first linear combination is equal to a calculated value of the second linear combination if the discrete Fourier transform over rings has been performed without error.

[0041] The method, according to exemplary embodiments, can include setting up and solving a system of equations, where each equation is formulated for a possible error location (in the path under consideration). Thus, the number of equations is determined by the number of butterfly operations in the transformation network, or more generally, by the transformation network itself.

[0042] Of course, this method can also be computer-implemented. That is, an exemplary embodiment includes a computer program for carrying out the method or the method steps.

[0043] In certain embodiments, the first and second weights depend on, or are determined in relation to, the transformation network. In these embodiments, the determination is based on the formula b = a · A introduced above, where A represents a matrix describing the behavior or inverse behavior of the transformation network 100. In further embodiments, additional conditions can be included, namely, where the first weights are defined by a first weighting vector a and the second weights by a second weighting vector b, where the first weighting vector a and the second weighting vector b are determined based on the formula b = a · A, where A represents a matrix describing the behavior or inverse behavior of the network.

[0044] According to one embodiment, the first weights b0 - b7 and second weights a0 - a7 can be determined under the condition that they satisfy the following inequalities: SlN2lm2+n2(a)=∑m1=0N2l−1ω2N(2(2lm1+m2)+1)n2a2lm1+m2≠00≤l≤log2(N),0≤n2≤2l−1,0≤m2≤N2l−1, where N denotes the dimension of the transformation network (100), where for each stage l = 0, ..., log2 N, and where m2 ∈ {0, ..., 2 l - 1} and n2∈{0,...,N2l−1} is.

[0045] The use of a first weighting vector and a second weighting vector aims to detect a single error. Depending on the embodiment, the error detection device can be configured to detect a single error when a calculated value of the first linear combination deviates from a calculated value of the second linear combination. For this purpose, a comparator is used, for example (see...). Fig. 5) used.

[0046] The detection of a single error is performed by comparing two weighted sums of the input signals f̂ and output signals f̂, respectively. To detect a single error, the block calculates Cout=a⋅f^ Cin=b⋅f. If C out == C in The block concludes that no error occurred if the value is 0. Otherwise, the block signals an error. The weights are chosen such that b = a · A. This ensures that C out == C in , if no error occurred. To ensure that every single error can be detected during the calculation, weights are additionally chosen to account for inequalities. SlN2lm2+n2(a)=∑m1=0N2l−1ω2N(2(2lm1+m2)+1)n2a2lm1+m2≠00≤l≤log2(N),0≤n2≤2l−1,0≤m2≤N2l−1, (negatively enveloped convolution-based NTT). The set of these equations is with S1 marked.

[0047] According to exemplary implementations, it would also be conceivable that the concept does not need to be determined for every position when finding the weights, but that simplification can be achieved by predefining individual weights, e.g. as zero or as one, in order to simplify the computational effort when determining the weights.

[0048] Fig. Figure 5 shows an NTT Butterfly network 100 together with the unit 310. The unit 310 has a comparator 322 which calculates the result c. in the first linear combination with the result c out compares the second linear combination: - C in is the sum of the input signals f0 - f7 weighted with first weights b0 - b7. - C out represents the summed result of the weighted outputs f̂0 - f̂7 with the second weights a0 - a7.

[0049] By selecting the weights as described above, every single fault in this network is guaranteed to be detected. This includes faults under a strong attacker model, where the fault value and fault position are controlled by the attacker.

[0050] According to one embodiment, the weights can also be defined by two first partial weighting vectors and two second partial weighting vectors. In this case, the two first and the two second weighting vectors are determined, according to the embodiment, such that the following inequalities are satisfied: SN2lm2+n2l(a(1))≠0SN2l 2+n2l(a(2))≠0SN2lm2+n2l(a((2))SN2l˜m˜2+n˜2(a(1))−SN2lm2+n2l(a(1))S N2l˜l˜m˜2+n˜2(a(2))≠0.0≤l,l˜≤log2(N),0≤n2,n˜2≤2l−1.0≤m2,m˜2≤N2l−1, where a triple l, n2 and m2 is not equal to a triple l̃, ñ2 and m̃2, where N specifies the dimension of the transformation network, where for each stage l and l̃ = 0, ..., log2 N, and where m̃2 and m2 ∈ {0, ... , 2 l - 1} as well as ñ2 and n2∈{0,...,N2l−1} is.

[0051] The background is that by using the partial weighting vectors, the error detection device is trained to detect a double error if a calculated value of the first linear combination calculated using one of the first two partial weighting vectors differs from a calculated value of the second linear combination calculated using a second of the two partial weighting vectors, or if a calculated value of the first linear combination calculated using another of the first two partial weighting vectors differs from a calculated value of the second linear combination calculated using a second of the two partial weighting vectors.

[0052] To detect two errors, two weighted sums are calculated for both the input and output signal values. To the best of our knowledge, no methods for double-error detection based on weighted sums are known, neither for the FFT nor for the NTT.

[0053] The coefficients of the outputs are given by the two vectors a (1) and a (2) The coefficients of the inputs are again given by the NTT of the output coefficients. The aforementioned inequalities are satisfied for error detection to be successful for any combination of two errors in the network. The set of these equations is given by S2 designated.

[0054] Fig. Figure 6 illustrates such a double fault detection system in the NTT network 100. Here, two comparators 122a are present in the fault detection device 310'. The two comparators are illustrated with the reference numbers 322a and 322b. To measure the two linear combinations c on the input side... in 1 and c in 2 To calculate, each input signal f̂0 - f̂7 is assigned two different weights. b01−b71 as well as b72 and b72 multiplied. The same applies to the initial values ​​f̂0 - f̂7, which are multiplied once by a01−a71 and once with a02−a72 to be multiplied. From the sum of the input values ​​f̂0 - f̂7 multiplied by b01−b71 will the sum c in 1 calculated while using the weights b02−b72 the sum c in 2is determined. On the output side, c out 1 based on the with a01−a71 weighted output signals f̂0 - f̂7 determined (sum), while c out 2 using the weights a02−a72 The sum is determined. By choosing the weights as described above, every combination of two errors in this network is guaranteed to be captured. This includes errors under a strong attacker model, where the error values ​​and error positions are controlled by the attacker.

[0055] If one abstracts some of the details described above, the conditions for the weightings of the input and output signals, i.e., the inequalities, become S1 and S2 Derived by evaluating parts of the butterfly network, starting from the assumed error position. Each position (or combination of two positions in the case of double error detection) corresponds to such an inequality and therefore a condition for the weightings. These concepts are formulated more abstractly below: One embodiment provides a method in which errors are detected by calculating weighted sums of the input and output signals of the (inverse) NTT and comparing the results. The weights are chosen such that they are the (inverse) NTTs of each other.

[0056] One embodiment provides a concept for determining the weights based on one or more conditions and / or using inequalities: • For example, the weightings are chosen such that the set of inequalities S1 is fulfilled. • For example, the weightings can be determined by performing a partial transformation. • For example, the weightings are determined by carrying out parts of the butterfly network. • Another embodiment provides a method in which two weighted sums are calculated and the weights are chosen such that the set of equations S2 is fulfilled. • In one embodiment, the weights of the two weighted sums are derived by partial transformations, so that the weighted sums of these partial transformations, which are interpreted as vectors, are linearly independent. • In one embodiment, the weighted sums are calculated on a subset of the inputs and outputs according to an incomplete (inverse) NTT. • Advantageously, the weights are chosen to enable efficient multiplication.

[0057] According to one embodiment, two half-size NTTs can be used equivalently to creating an error detection scheme.

[0058] According to one example, each transformation network can be split into several subnetworks. Fig. Figure 7 shows a transformation network 310' with two transformation network sections 100a' and 100b' to illustrate single-fault detection schemes for the case of log2(N) - 1 stages. Here, network sections 100a' and 100b' each contain two stages with two butterfly operations each, designated by reference numerals 120a, 120b, 120e and 120f for network section 100a' and by reference numerals 120c and 120d as well as 120g and 120h for network section 100b'. 100a' processes the "even" input signals f0, f4, f2 and f6 (corresponding to a subset of the multiple input signals) and outputs the even output signals f̂0, f̂4, f̂2 and f̂6 (corresponding to a subset of the multiple output signals).Network 100b' processes the "odd" input signals f1, f5, f3, and f̂7 (corresponding to a further subset of the multiple input signals) and outputs the "odd" output signals f̂1, f̂5, f̂3, and f̂7 (corresponding to a subset of the multiple output signals). A separate c is provided for each network section 100a' and 100b' by the fault detection device 320". in -value and c outThe value of the linear combination is calculated and compared with comparators 322a and 322b. For this purpose, partial weighting vectors are used according to the exemplary embodiments, where one first partial weighting vector has the weights b0, b4, b2, and b6, and the other first partial weighting vector has the weights b1, b5, b3, and b7. One second partial weighting vector has the weights a0, a4, a2, and a6, while the other second partial weighting vector has the weights a1, a5, a3, and a7. These are used for multiplication by the respective inputs f0–f7 and the respective outputs f̂0–f̂7, which are then summed for each network component 100a' and 100b' on both the input and output sides.

[0059] Some cryptographic schemes use incomplete NTTs (also called incompletely divided NTTs) in their calculations. In this case, the NTT does not consist of the full log2(N) stages, but instead stops before reaching the final stage. The same error detection concept as described above can be applied to this type of NTT by dividing it into sub-parts, which in turn act as smaller NTTs.

[0060] For example from Fig. 7. It should be noted that, according to the exemplary implementations, the number of butterfly operations per network segment 100a' or 100b' can also differ. Of course, multiple network segments can also be provided. By dividing the network into several network segments, it is advantageously possible not only, as in Fig. Figure 3 shows how to output an error signal indicating that an error has occurred, but also how to locate the error, at least in terms of the network part.

[0061] Although the above example always assumes negatively enveloped convolution-based NTTs, the principle is transferable to all types of transformation networks. For example, a positively enveloped convolution-based NTT or its corresponding inverse can also be used.

[0062] For the sake of simplicity, the preceding detailed descriptions apply only to negatively enveloped convolution-based NTT. However, the same concepts also apply to positively enveloped convolution-based NTT and their respective inverses.

[0063] Although the in Fig.While the functional architecture shown in Figure 3 may resemble a hardware implementation, it should be noted that this is only one functional view and several implementations are conceivable, including but not limited to: • Parallel HW: NTT and fault detection are performed by separate HW blocks, with the respective calculations being carried out in parallel (where possible). • Alternatively, Sequential HW: The NTT and error detection are performed by the same HW blocks, which execute the calculations sequentially. This setting covers the general configuration of (inverse) NTT accelerators, which consist of some memory, a HW block implementing the butterfly operation, and control logic. In this case, the only additional HW overhead would be more complex control logic. • Alternative, HW / SW: A system consisting of a CPU and a hardware accelerator for (inverse) NTT, which can be used by the CPU, is considered. The CPU outputs a new NTT calculation to the hardware. While the accelerator block is occupied, the hardware begins processing the input signals and, upon receiving the results from the accelerator block, checks whether any errors occurred during this calculation by performing the remaining operations on the outputs.

[0064] Applications for the transformation networks described above include coding applications, such as asymmetric cryptography, which is used in many automotive applications. For example, numerous electronic control units (ECUs) utilize encryption functions for key exchange or the key exchange protocol, or for verifying software updates. In this respect, one embodiment provides an ECU, particularly a vehicle ECU, with a corresponding encryption device, especially one based on post-quantum or asymmetric encryption. Embodiments of the present invention reduce the space and / or time overhead in computing such algorithms by easily implementing error detection, as used in some NTTs.A further advantage is that this type of error detection also identifies errors that occur during the transmission of data from one butterfly operation to the next, and not only errors that can occur during the calculation within the butterfly cell. The calculation of the checksum, or more generally the linear combination, is simple and can be performed using the same elements that also form the transformation network, e.g., serially, that is, after the transformation. In this respect, embodiments of the present invention increase reliability and safety.

[0065] Although some aspects have been described in connection with a device, it is understood that these aspects also constitute a description of the corresponding process, such that a block or component of a device can also be understood as a corresponding process step or as a feature of a process step. Similarly, aspects described in connection with or as a process step also constitute a description of a corresponding block, detail, or feature of a corresponding device. Some or all of the process steps can be performed by (or using) a hardware apparatus, such as a microprocessor, a programmable computer, or an electronic circuit. In some embodiments, some or more of the key process steps can be performed by such an apparatus.

[0066] Depending on specific implementation requirements, embodiments of the invention can be implemented in hardware or in software. The implementation can be carried out using a digital storage medium, for example, a floppy disk, DVD, Blu-ray disc, CD, ROM, PROM, EPROM, EEPROM, FLASH memory, hard disk, or other magnetic or optical storage medium, on which electronically readable control signals are stored. These control signals can interact with, or interact with, a programmable computer system in such a way as to execute the respective method. Therefore, the digital storage medium can be computer-readable.

[0067] Some embodiments according to the invention therefore include a data carrier which has electronically readable control signals which are able to interact with a programmable computer system in such a way that one of the methods described herein is carried out.

[0068] In general, embodiments of the present invention can be implemented as a computer program product with a program code, wherein the program code is effective in carrying out one of the methods when the computer program product runs on a computer.

[0069] The program code can also be stored on a machine-readable medium, for example.

[0070] Other embodiments include a computer program for carrying out one of the methods described herein, wherein the computer program is stored on a machine-readable medium. In other words, an embodiment of the method according to the invention is thus a computer program that includes program code for carrying out one of the methods described herein when the computer program is executed on a computer.

[0071] Another embodiment of the methods according to the invention is therefore a data carrier (or a digital storage medium or a computer-readable medium) on which the computer program for carrying out one of the methods described herein is recorded.

[0072] Another embodiment of the method according to the invention is thus a data stream or a sequence of signals that represents the computer program for carrying out one of the methods described herein. The data stream or sequence of signals can be configured, for example, to be transferred via a data communication connection, such as the Internet.

[0073] Another embodiment comprises a processing device, for example a computer or a programmable logic device, which is configured or adapted to perform one of the methods described herein.

[0074] Another embodiment comprises a computer on which the computer program for performing one of the procedures described herein is installed.

[0075] Another embodiment of the invention comprises a device or system designed to transmit a computer program for carrying out at least one of the methods described herein to a receiver. The transmission can be, for example, electronic or optical. The receiver can be, for example, a computer, a mobile device, a storage device, or a similar device. The device or system can, for example, include a file server for transmitting the computer program to the receiver.

[0076] In some embodiments, a programmable logic device (for example, a field-programmable gate array, an FPGA) can be used to perform some or all of the functionalities of the methods described herein. In some embodiments, a field-programmable gate array can interact with a microprocessor to perform one of the methods described herein. Generally, in some embodiments, the methods are performed by any hardware device. This can be general-purpose hardware such as a computer processor (CPU) or method-specific hardware such as an ASIC.

[0077] The embodiments described above merely illustrate the principles of the present invention. It is understood that modifications and variations of the arrangements and details described herein will be obvious to other people skilled in the art. Therefore, it is intended that the invention be limited only by the scope of protection set forth in the following claims and not by the specific details presented herein by way of description and explanation of the embodiments. References 1 NI for Standards and T. (NIST), Post-Quantum Cryptography, Selected Algorithms 2022. https: / / . csrc.nist.gov / Projects / post-quantum-cryptography / selected-algorithms-2022. [On-line]. Available: https: / / csrc.nist.gov / Projects / post-quantum-cryptography / selected-algorithms-2022. 2 C. A. for Cryptologic Research (CACR), Chinese Post-Quantum Competition. 2020. Accessed: Jun.. 29, 2023. [Online]. Available: https: / / www.cacrnet.org.cn / site / content / 854.html 3 A. Sarker, M. Mozaffari-Kermani, and R. Azarderakhsh, „Hardware . Constructions for Error Detection of Number-Theoretic Transform Utilized in Secure Cryptographic Architectures,“ IEEE Transactions on Very Large Scale Integration (VLSI) Systems, vol. 27, no. 3, pp. 738-741, Mar. 2019, doi: 10.1109 / TVLSI.2018.2881097. 4 A. Sarker, M. M. Kermani, and R. Azarderakhsh, „Error Detection Architectures for Ring Polynomial . Multiplication and Modular Reduction of Ring-LWE in $\boldsymbol\frac\math-bbZ / p\mathbbZ[x]x^n+1$. Benchmarked on ASIC,“ IEEE Transactions on Reliability, vol. 70, no. 1, pp. 362-370, Mar. 2021, doi: 10.1109 / TR.2020.2991671. 5 A. Sarker, AC Canto, MM Kermani, and R. Azarderakhsh, "Error Detection Architectures for. Hardware / Software Co-design Approaches of Number-Theoretic Transform," IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, pp. 1-1, 2022, doi: 10.1109 / TCAD.2022.3218614. 6 DL Tao and CRP Hartmann, “A novel concurrent error detection scheme for FFT networks,” . IEEE Transactions on Parallel and Distributed Systems, vol. 4, no. 2, pp. 198-221, Feb. 1993, doi: 10.1109 / 71.207595. QUOTES INCLUDED IN THE DESCRIPTION

[0000] This list of documents cited by the applicant was automatically generated and is included solely for the reader's convenience. The list is not part of the German patent or utility model application. The DPMA accepts no liability for any errors or omissions. Cited non-patent literature

[0000] C. A. for Cryptologic Research (CACR), Chinese Post-Quantum Competition. 2020. Accessed: Jun.. 29, 2023. [Online]. Available: https: / / www.cacrnet.org.cn / site / content / 854.html

[0077] A. Sarker, M. Mozaffari-Kermani, and R. Azarderakhsh, „Hardware . Constructions for Error Detection of Number-Theoretic Transform Utilized in Secure Cryptographic Architectures,“ IEEE Transactions on Very Large Scale Integration (VLSI) Systems, vol. 27, no. 3, pp. 738-741, Mar. 2019, doi: 10.1109 / TVLSI.2018.2881097

[0077] A. Sarker, M. M. Kermani, and R. Azarderakhsh, „Error Detection Architectures for Ring Polynomial . Multiplication and Modular Reduction of Ring-LWE in $\boldsymbol\frac\math-bbZ / p\mathbbZ[x]x^n+1$. Benchmarked on ASIC,“ IEEE Transactions on Reliability, vol. 70, no. 1, pp. 362-370, Mar. 2021, doi: 10.1109 / TR.2020.2991671

[0077] A. Sarker, A. C. Canto, M. M. Kermani, and R. Azarderakhsh, „Error Detection Architectures for. Hardware / Software Co-design Approaches of Number-Theoretic Transform,“ IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, pp. 1-1, 2022, doi: 10.1109 / TCAD.2022.3218614

[0077] D. L. Tao and C. R. P. Hartmann, „A novel concurrent error detection scheme for FFT networks,“ . IEEE Transactions on Parallel and Distributed Systems, vol. 4, no. 2, pp. 198-221, Feb. 1993, doi: 10.1109 / 71.207595

[0077]

Claims

[1] Device (300) for encryption, comprising the following features: a transformation network (100) with at least two stages (110a, 110b, 110c) of butterfly operations, wherein the transformation network (100) is configured to perform a discrete Fourier transformation over rings of multiple input signals (f0 - f7) to obtain multiple output signals (f̂0 - f̂7); a fault detection device (110) configured to obtain at least a subset of the multiple input signals (f0 - f̂7) and at least a subset of the multiple output signals (f̂0 - f̂7) of the transformation network (100) and to perform an error analysis, wherein the error analysis is based on a comparison of a first linear combination of the subset of multiple input signals (f0 - f̂7) to a second linear combination of the subset of multiple output signals (f0 - f̂7). [2] Device (300) for encryption according to claim 1, wherein the first linear combination is determined using first weights (b0 - b7) per input signal (f0 - f̂7) and / or where the second linear combination is determined using second weights (a0 - a7) for each output signal (f̂0 - f̂7). [3] Device (300) for encryption according to claim 2, wherein the first weights (b0 - b7) and the second weights (a0 - a7) depend on the transformation network (100) or are determined in advance depending on the transformation network (100). [4] Device (300) for encryption according to one of claims 2 to 3, comprising a memory in which the first weights (b0 - b7) and second weights (a0 - a7) belonging to the transformation network (100) or belonging to a software component in which the transformation network (100) is implemented are stored. [5] Device (300) for encryption according to any one of claims 2 to 4, wherein the first weights (b0 - b7) are defined by a first weighting vector a and the second weights (a0 - a7) by a second weighting vector b, wherein the first weighting vector a and the second weighting vector b are determined based on the formula b = a · A, where A is a matrix that describes the behavior or the inverse behavior of the transformation network (100). [6] Device (300) for encryption according to any one of claims 2 to 5, wherein the first weights (b0 - b7) and second weights (a0 - a7) are determined subject to the condition that they satisfy the following inequalities: SlN2lm2+n2(a)=∑m1=0N2lω2N(2(2lm1+m2)+1)n2a2lm1+m2≠00≤l≤log2(N),0≤n2≤2l−1,0≤m2≤N2l−1, where N denotes the dimension of the transformation network (100), where for each stage l = 0, ..., log2 N, and where m2 ∈ {0, ..., 2 l - 1} and n2∈{0,...,N2l−1} is. [7] Device (300) for encryption according to one of the preceding claims, wherein the error detection device (110) is configured to detect a single error when a calculated value of the first linear combination differs from a calculated value of the second linear combination. [8] Device (300) for encryption according to one of claims 2 to 4, wherein the first weights (b0 - b7) are defined by two first partial weighting vectors and the second weights (a0 - a7) are defined by two second partial weighting vectors. [9] Device (300) for encryption according to claim 8, wherein the weights of the two first partial weighting vectors and the weights of the two second partial weighting vectors are determined such that they satisfy the following inequalities: SN2lm2+n2l(a(1))≠0SN2lm2+n2l(a(2))≠0SN2lm2+n2l(a((2))SN2l˜m˜2+n˜2(a(1))−SN2l m2+n2l(a(1))SN2l˜m˜2+n˜2(a(2))≠0.0≤l,l˜≤log2(N),0≤n2,n˜2≤2l−1.0≤m2,m˜2≤N2l−1 where a triple l, n2 and m2 is not equal to a triple l̃, ñ2 and m̃2, where N denotes the dimension of the transformation network (100), where for each stage l and l̃ = 0, ..., log2 N, and where m̃2 and m2 ∈ {0, ..., 2 l - 1} as well as ñ2 and n2∈{0,…,N2l−1} is. [10] Device (300) for encryption according to one of claims 8 or 9, wherein the error detection device (110) is configured to detect a double error if a calculated value of the first linear combination calculated using one of the first two partial weighting vectors differs from a calculated value of the second linear combination calculated using one of the second partial weighting vectors, or if a calculated value of the first linear combination calculated using another of the first two partial weighting vectors differs from a calculated value of the second linear combination calculated using another of the second partial weighting vectors. [11] Device (300) for encryption according to one of the preceding claims, wherein the transformation network (100) comprises one or more split transformation network parts and wherein the subset of multiple input signals (f0 - f̂7) and the subset of multiple output signals (f̂0 - f̂7) comprise the multiple input signals (f0 - f̂7) and the multiple output signals (f0 - f̂7) of a split transformation network part; or wherein the subset of multiple input signals (f0 - f̂7) and the subset of multiple output signals (f0 - f̂7) comprise all input signals (f0 - f̂7) and all output signals (f0 - f̂7) of the transformation network (100). [12] Device (300) for encryption according to any one of claims 2 to 11, wherein each nth of the first weights (b0 - b7) or each nth of the second weights (a0 - a7) with n >= 2 are determined by a predefined weighting factor, in particular a weighting factor 1. [13] Device (300) for encryption according to one of the preceding claims, wherein the error detection device (110) is implemented in hardware; or wherein the error detection device (110) is implemented as a software component, in particular the error detection device (110) is implemented as a software component that is executed on a computing unit of the device (300) for encryption; or wherein the error detection device (110) is implemented as a software component that is executed on a computing unit of the device (300) for encryption, wherein a software component for implementing the transformation network (100) is executed on the same computing unit. [14] Data carrier comprising a first and a second software component, wherein the first software component is configured to implement a transformation network (100) with at least two stages (110a, 110b, 110c) of butterfly operations, wherein the transformation network (100) is configured to perform a discrete Fourier transformation over rings of multiple input signals (f0 - f̂7) to obtain multiple output signals (f0 - f̃7); wherein the second software component is configured to implement a fault detection device (110) which is configured to obtain at least a subset of the multiple input signals (f0 - f̂7) and at least a subset of the multiple output signals (f0 - f̂7) of the transformation network (100) and to perform a fault analysis, wherein the fault analysis is based on a comparison of a first linear combination of the subset of multiple input signals (f0 - f̂7) to a second linear combination of the subset of multiple output signals (f0 - f̂7). [15] Encryption procedure comprising the steps: Performing a discrete Fourier transform over rings of multiple input signals (f0 - f̂7) using a transformation network (100) with two stages (110a, 110b, 110c) of butterfly operations to obtain multiple output signals (f0 - f̃7); Obtain at least a subset of the multiple input signals (f0 - f̂7) and at least a subset of the multiple output signals (f0 - f̂7) of the transformation network (100) and perform an error analysis, wherein the error analysis is based on a comparison of a first linear combination of the subset of multiple input signals (f0 - f̂7) to a second linear combination of the subset of multiple output signals (f0 - f̂7). [16] Computer program for carrying out the method according to claim 15, when the method runs on a processor. [17] Device (300) for determining first weights (b0 - b7) and second weights (a0 - a7) depending on a transformation network (100) which has at least two stages (110a, 110b, 110c) of butterfly operations and is configured to perform a discrete Fourier transformation over rings of several input signals (f0 - f̂7) to obtain at least several output signals (f̂0 - f̂7), where a first linear combination of the subset of multiple input signals (f0 - f̂7) can be computed using the first weights (b0 - b7) and where a second linear combination of the subset of multiple output signals (f0 - f̂7) can be computed using the second weights (a0 - a7), where the first and second weights are determined such that a calculated value of the first linear combination is equal to a calculated value of the second linear combination if the discrete Fourier transform over rings has been performed without error. [18] Device (300) according to claim 17, wherein the first weights (b0 - b7) and the second weights (a0 - a7) depend on the transformation network (100) or are determined depending on the transformation network (100). [19] Device (300) according to claim 17 or 18, wherein the first weights (b0 - b7) are defined by a first weighting vector a and the second weights (a0 - a7) are defined by a second weighting vector b, wherein the first weighting vector a and the second weighting vector b are determined based on the formula b = a · A, where A is a matrix that describes the behavior or the inverse behavior of the network. [20] Device (300) according to one of claims 17 to 19, wherein the first weights (b0 - b7) and second weights (a0 - a7) are determined under the condition that they satisfy the following inequalities: SN2lm2+n2l(a)=∑m1=0N2l−1ω2N(2(2lm1+m2)+1)n2a2lm1+m2≠00≤l≤log2(N),0≤n2≤2l−1.0≤m2≤N2l−1, where N specifies the dimension of the transformation network (100), where for each stage l = 0, ..., log2 N, and where m2 ∈ {0, ...,2 l - 1} and n2∈{0,…,N2l−1} is. [21] Device (300) according to any one of claims 17 to 20, wherein the first weights (b0 - b7) are defined by two first partial weighting vectors and the second weights (a0 - a7) are defined by two second partial weighting vectors. [22] Device (300) according to one of claims 17 to 21, wherein the two first partial weighting vectors and the two second partial weighting vectors are determined such that they satisfy the following inequalities: SN2lm2+n2l(a(1))≠0SN2l 2+n2l(a(2))≠0SN2lm2+n2l(a((2))SN2l˜m˜2+n˜2(a(1))−SN2lm2+n2l(a(1))S N2l˜l˜l˜m˜2+n˜2(a(2))≠0.0≤l,l˜≤log2(N),0≤n2,n˜2≤2l−1.0≤m2,m˜2≤N2l−1 where a triple l, n2 and m2 is not equal to a triple l̃, ñ2 and m̃2, where N denotes the dimension of the transformation network (100), where for each stage l and l̃ = 0, ..., log2 N, and where m̃2 and m2 ∈ {0, ..., 2 l - 1} as well as ñ2 and n2∈{0,…,N2l−1} is. [23] Method for determining first and second weights depending on a transformation network (100) having at least two stages (110a, 110b, 110c) of butterfly operations and configured to perform a discrete Fourier transform over rings of several input signals (f0 - f7) to obtain at least several output signals (f̂0 - f̂7), where, using the first weights (b0 - b7), a first linear combination of the subset of the multiple input signals (f0 - f7) can be computed, and where, using the second weights (a0 - a7), a second linear combination of the subset of the multiple output signals (f0 - f̂7) can be computed, where the first and second weights are determined such that a calculated value of the first linear combination is equal to a calculated value of the second linear combination if the discrete Fourier transform over rings has been performed without error. [24] Computer program for carrying out the method according to claim 23 when the method is executed on a processor.

Images